What is the CVSS score of CVE-2026-62514?

CVE-2026-62514 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-62514?

Oracle Process Manufacturing Regulatory Management within E-Business Suite versions 12.2.3-12.2.15 allows authenticated attackers with low system privileges to read, create, delete, or modify all…

How to fix or mitigate CVE-2026-62514?

Within 24 hours, identify all E-Business Suite deployments running versions 12.2.3 through 12.2.15 and locate systems with Process Manufacturing Regulatory Management enabled; begin immediate review of access logs for suspicious activity against the component. Within 7 days, implement network-level access controls restricting HTTP traffic to this module to essential business users only, deploy Web Application Firewall rules to block abnormal data modification patterns, and enable comprehensive audit logging of all create, update, and delete operations on manufacturing data. Within 30 days, establish continuous monitoring of Oracle security bulletins for patch release notifications; if a vendor-released patch becomes available, prioritize testing and deployment based on your compliance obligations for regulated manufacturing environments.

Oracle E-Business Suite CVE-2026-62514

EUVD-2026-47535 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gg7c-q6gm-6q67

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP exploitation (AV:N/AC:L) needs a low-privileged EBS account (PR:L), no user interaction; full read/write to component data (C:H/I:H) with no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:38 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Regulatory Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Regulatory Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Regulatory Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).

Technical ContextAI

The affected component is the Regulatory Management module of Oracle Process Manufacturing (OPM), part of the Oracle E-Business Suite (EBS) 12.2 application stack, exposed via HTTP/HTTPS on the EBS web tier (Oracle HTTP Server/WebLogic front end). OPM Regulatory Management handles compliance documentation such as material safety data sheets and hazard/regulatory data for process manufacturing. No CWE was assigned by NVD for this issue, so the exact root-cause class is unconfirmed from available data; the CVSS profile (network HTTP, low complexity, low privilege, high C and I, no A) combined with the 'Authentication Bypass' tag is consistent with a broken-access-control or authorization flaw (roughly CWE-284/CWE-863) that lets an authenticated low-privilege user reach data or operations beyond their intended entitlement, rather than a memory-corruption or availability bug.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS 12.2 security fixes as cumulative CPU patches applied on top of the relevant 12.2.x code level rather than as a new product version, and the input does not name a specific fix build, so treat 'apply the July 2026 CPU patch for your 12.2.x level' as the primary remediation (patch available per vendor advisory; exact patched build not independently confirmed here). Until patched, reduce exposure by restricting network reach to the OPM Regulatory Management pages on the EBS web tier - limit access to trusted internal networks or VPN, tighten URL firewall / allow-list rules on the Oracle HTTP Server to block external access to the Regulatory Management responsibilities and pages, and review and minimize which user accounts hold OPM responsibilities since a low-privileged account is a prerequisite; the trade-off is that overly broad URL blocking can disrupt legitimate OPM users, so scope rules to the affected functions. Monitor EBS application and access logs for anomalous data reads or modifications by low-privilege accounts as a compensating detective control.